Electronic mail, commonly known as e-mail, is a service for the transmission of messages over a communications network offered by online services and Internet Service Providers (ISPs). The messages, entered from an input device connected to a computer, can be text, electronic files, or a combination of both text and files. E-mail is received in an electronic mailbox from which it can be read, stored in a text file, forwarded to another address, or deleted. E-mails may be sent to a mailing list so that the message is automatically sent to all of the e-mail addresses on the list.
In addition to e-mail which is an SMTP protocol, messages can be posted to an on-line discussion group via the NNTP protocol. For example, USENET provides a bulletin board that can be accessed worldwide through the Internet via the NNTP protocol. USENET employs e-mail addresses to sign messages so that the e-mail address is exposed to the Internet in postings.
A problem arises in that much e-mail is not solicited and is not wanted. Nevertheless, it must be processed at the mailbox. The large amount of unwanted e-mail is due to three factors: e-mail is extremely easy to send, it is extremely inexpensive in relation to the number of messages that can be delivered, and addresses are easy to obtain. E-mail addresses are easy to obtain because programs can be written to automatically acquire addresses from mailing lists or on line discussion group message boards. In addition, programs can generate addresses from simple alpha numeric generation, some of which will coincide with actual addresses.
Unwanted e-mail is often referred to as “spam.” As used herein, the term “spam” shall mean any unwanted e-mail sent to a person with a mailbox for receiving e-mails. Many methods for unsolicited e-mail are known. AMERICA ON LINE and PRODIGY use a filter that excludes e-mail addresses that are identified with unsolicited mail. Since the law does not allow ISPs to automatically block e-mail addresses, such filters are only available upon user request. Additionally, such an approach will always lag behind rapid changes in the source of unsolicited e-mail. Other methods are based upon inclusion lists. Inclusion lists require continual manual updating. Therefore, applications for dealing with spam can be analyzed in terms of those that are based on exclusion and those that are based on inclusion.
A number of United States patents have been granted in the area of spam exclusion. In general, exclusion methods seek to identify the source or content of the unwanted e-mail and to identify it for deletion or exclusion from the mailbox. U.S. Pat. No. 6,578,025 to Pollack (the '025 patent) discloses a method for providing information based on the relevancy of the information to the users to whom the information is provided. The method of the '025 patent includes receiving an incoming message and generating similarity scores indicating similarities between the incoming message and features of a plurality of messages. The similarity score may be based upon a message feature database. The similarity score is used to develop a relevancy score based on a user profile. U.S. Pat. No. 5,826,022 discloses a mechanism for ignoring a particular on-going e-mail discussion using an ignored discussion database configured to store information relating to a recipient selected discussion.
U.S. Pat. No. 6,249,805 to Fleming discloses a filtering system that uses a list to identify authorized senders. U.S. Pat. No. 6,321,267 (the '267 patent) to Donaldson discloses a proxy that actively probes remote hosts in order to identify dial up PC's, open relays, and forged e-mail. In the '267 patent, a sender's message must pass through all layers of protection. If the sender's message does not pass through all layers, it is rejected and logged. Subsequent mail from the same host is blocked. U.S. Pat. No. 6,615,242 (the '242 patent) to Riemers discloses a system to identify spam by identifying a Uniform Resource Locator (URL) in a message and fetching information from the URL. The information is analyzed to determine whether the message that includes the URL is spam. If a determination is made that the message is spam, action is taken, such as deleting the message, displaying the message with a flag, and/or sending the message to a third party. U.S. Pat. No. 6,052,709 to Paul (the '709 patent) discloses a method for controlling delivery of unsolicited e-mail. In the '709 patent, one or more spam probe e-mail addresses are created and ″planted at various sites on the communication network in order to insure their inclusion on spam mailing lists. The mailbox corresponding to the spam probe is monitored and incoming mail is analyzed to identify the source of the message. An alert signal is generated containing the spam source data. The alert signal is broadcast to all network servers for action by the filtering system.
A number of United States patents have been granted based upon user inclusion. U.S. Pat. No. 5,999,932 to Paul (the '932 patent) discloses a system for eliminating unsolicited electronic mail. In the '932 patent, if data from one or more fields of an incoming mail message matches identification data in a user inclusion list, the message is marked “OK.” If no match is made, at least one heuristic process is used to determine whether the mail may be of interest to the user. If the message satisfies one or more criteria from the process, it is marked “NEW.” If the message does not satisfy any criteria of the process, the message is marked “JUNK.” U.S. Pat. No. 6,266,692 to Greenstein (the '692 patent) discloses a method for blocking and/or filtering unwanted e-mail by providing selected senders with a passcode. In the '592 patent, when an e-mail is received at a mail server node, a field in the header of the message is checked. If the passcode is correct, the message is sent. If the passcode is incorrect, the message is deleted. If there is no passcode, the message is held until the receiver approves.
All methods, whether based upon exclusion or inclusion, rely on filters. Currently known techniques for filtering include Bayesian filtering, subject filtering, sender filtering, or heuristic filtering that examine individual messages or groups of messages sent to a single e-mail address. Such filtering methods may look at the sender address to either determine exclusion or inclusion. However, many spam messages come from random e-mail addresses that vary on a per-recipient basis in order to defeat “blacklisting” of certain sender e-mails. Therefore, other elements of the message must be considered. For example, Bayesian filtering relies heavily on keyword frequency.
Many email recipients have more than one address and receive e-mail at multiple addresses. It is quite common for individuals to have multiple email addresses that forward to a common location/server or “canonical email address” where they read their mail. As discussed above, current anti-spam technologies evaluate e-mail messages on attributes of the sender. In other words, the “From:” information is scrutinized for the sender's address, the SMTP relays, crosses, subject, line count, attachments, or other headers. However, no method or application is known that examines the email address by which the message arrives in the mailbox. In other words, the above described solutions do not look at the “To:” section of the e-mail, the address to which the e-mail was sent. In addition there are no known methods that analyze the “Received” header, which is necessary in order to determine the true recipient address. Analysis of the “Received” header is necessary because spam senders routinely ignore the “To:” headers and blind copy the spam targets. There are no known spam filtering methods that are based upon examination of e-mail from the perspective of multiple recipient e-mail addresses for a single user.
What is needed is a method of identifying spam that looks at patterns in e-mails sent to multiple recipient addresses received by a single e-mail server. What is further needed is a method to identify spam based on the recipient address at which an e-mail was received, so that a suspiciously similar e-mail sent to different address can be identified and analyzed. In addition, a need arises for a process that can “learn” so that as additional e-mail is received, the process can go back and tag an email after it has been processed (for example, when a 6th message is received that is found to be similar and the score for that e-mail is added to the previous five similar e-mails). In this way an e-mail that may not immediately be identified as “spam” can be tagged as such after sufficient additional e-mails are received to make a more positive identification.